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Distributed-phase-reference quantum key distribution stands out for its easy implementation with 
present day technology. Since many years, a full security proof of these schemes in a realistic setting 
has been elusive. For the first time, we solve this long standing problem and present a generic 
method to prove the security of such protocols against general attacks. To illustrate our result we 
provide lower bounds on the key generation rate of a variant of the coherent-one-way quantum key 
distribution protocol. In contrast to standard predictions, it appears to scale quadratically with the 
system transmittance. 
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Introduction. — Quantum key distribution (QKD) is on 
the verge to become a standard tool for secure communi- 
cations [lj. In its original proposal QKD is based on the 
transmission of single photons. However, since true single 
photon sources are not available yet most experimental 
prototypes and all current commercial products of QKD 
use weak laser pulses. A main drawback of these sys- 
tems is that some signals contain more than one photon 
prepared in the same quantum state. This fact severely 
limits the distances that can be achieved by these tech- 
niques due to the photon number splitting attack [2] . 

To enhance the performance of practical QKD sys- 
tems, several approaches have been proposed. One so- 
lution is to send a strong reference pulse together with 
the quantum signals 0]. A second approach is based 
on the decoy state method, where the transmitter sends 
states with different intensities [4|]. Both schemes pro- 
vide a secret key generation rate that scales linearly with 
the system transmittance @, 0j- A third alternative is 
to use distributed-phase-reference (DPR) QKD proto- 
cols. They differ from standard QKD schemes in that 
the receiver now performs joint measurements onto sub- 
sequent signals, often given in the form of coherence mea- 
surements [a, |g] . This approach includes the differential- 
phase- shift [j| and the coherent-one-way (COW) @ pro- 
tocols. In the former, the sender prepares coherent states 
of equal intensity but modulates their phases; in the 
COW protocol all pulses share a common phase but their 
intensities vary. A complete security proof of DPR-QKD 
in a realistic setting has been missing since many years. 
Security has only been proven so far against restricted 
types of attacks lZHSI, or assuming the use of ideal single 
photon sources [101 ] . 

In this Letter we present a generic method to prove 
security of practical DPR-QKD against general attacks. 
This solves a long standing open question in the field of 
quantum communications [lj]. We illustrate our result 
by providing non-trivial lower bounds for a variant of 



the original COW protocol 11 1, which maintains all the 
practical advantages. Our analysis suggests that prac- 
tical DPR-QKD might not be as robust against imper- 
fections as initially foreseen, i.e., its key rate appears to 
scale quadratically with the system transmittance. 

Security discussion. — The challenge in DPR-QKD is 
to prove security against general, also termed coherent 
attacks. Usually such attacks are known to be of no ad- 
vantage to the eavesdropper (Eve) in comparison to col- 
lective attacks by virtue of the de Finetti theorem [12j . 
This theorem applies, for instance, when the underly- 
ing quantum state shared by the legitimate users (Al- 
ice and Bob) is permutationally invariant. In standard 
QKD this is typically ensured by performing simultane- 
ous random permutations on the classical measurement 
results. DPR-QKD defines however a fixed ordering of 
the signals by its coherence measurement and, therefore, 
it is not possible to permute the classical outcomes with- 
out destroying vital information [13]. However, such a 
predicament can be circumvented by grouping the en- 
tire signal stream into blocks. More specifically, consider 
that Alice and Bob group their signals into subsequent 
blocks of size m, where the length m is optimized for the 
expected behaviour. When permuting these blocks one 
preserves the coherence information within them while 
the information between the blocks is destroyed. Still 
this is enough to apply the de Finetti argument on the 
level of blocks. As a result, the state shared by Alice 
and Bob after distributing a large number mN of signals 
satisfies p™^ ~ /9™ B ® and security against collective 
attacks on these signal blocks implies security against 
coherent attacks in the original setting. 

Suppose that the state shared by Alice, Bob and Eve 
after transmitting an m block signal is p™ BE . Let us first 
consider the effect of public announcements by Alice and 
Bob based on their classical measurement results. This 
announcement, labelled as v, allows both parties to dis- 
tinguish between conclusive events that contribute to the 
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sifted key and inconclusive ones that are discarded. On 
the level of quantum states this is described by suitable 
maps A^Cg) A^. Given an announcement v, that happens 
with probability p(v), the three parties share the state 
°Abe,v determined by A^ ® A*(p% BE ) = p{v)a^ >v . 

For each announcement v one can use a one-way clas- 
sical post-processing key rate formula 14 \. If system A 
denotes a qubit and Alice's raw key is obtained by pro- 
jecting this system onto the orthogonal states |0) A , |1) A , 
then a lower bound on the secret key rate is given by 
1 — h 2 (e v ) — h 2 (6 v ). Here h 2 represents the binary en- 
tropy, e v is the symmetrized bit error between the key 
measurements of Alice and Bob, and S v denotes the cor- 
responding error, typically called phase error, when Al- 
ice performs a measurement in a mutually unbiased basis 
and Bob in his other different setting. This last parame- 
ter is used to upper bound Eve's knowledge on the sifted 
key generated by Alice. Note that S v does not need to be 
measured directly, it only needs to be estimated. When 
Bob's measurements are similar qubit measurements like 
the ones of Alice then the expression above represents 
the Shor-Preskill key rate formula [H| . 

To consider that the output system A is a qubit implies 
that Alice can, at best, distill one secret bit per block. 
Nevertheless this restriction should not have a significant 
impact on the key rate in a long distance regime, since 
Bob observes, if any, most often only one single conclusive 
event per m arriving signals due to the high losses in the 
channel (given that m is not too big). 

Instead of estimating separate phase errors S v , it is 
often easier to combine all conclusive announcements v £ 
V c into an averaged version. Let G — YlveV p( v ) — ^ 
denote the total sifted key gain. Then, we have that the 
secret key rate per block can be bounded by 
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Here one uses concavity of h 2 to lower bound R m by the 
averaged (conditional) error rates e c = YlveV P( v ) e v/G 
and 5 = J^ugv Pi v )^v ■ The last step takes into account 
that e c and G are observed quantities and that the opti- 
mization is attained at the largest phase error $ max com- 
patible with the obtained data since h 2 increases in [0, ^}. 

Phase error estimation. — The main difficulty to com- 
pute Eq. ((2J is to upper bound the average phase error S. 
This parameter can be expressed as an expectation value 
on the original bipartite state p™ B — trE(p™ BE ) using 
adjoint maps 
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tr[A>A*(p£ B )F 5 J 
= tr[p A l B £ A^t ® Af (J*,)] = tr(p£ B Fj). (3) 
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Here F$ v denote the corresponding phase error operators 
on the state a 



ab ■ 



Partial knowledge of Alice and Bob 
about the state p™ B can be parsed as known expectation 
values hi = ti(p™ B Ki) for certain operators Ki. This 
means that the search for the maximum phase error £ max 
can be cast into the form of a semidefinite program [l6| , 



maxtr(p^ B Fj) 
s.t. pXb h 0, tr(p A l B J^) 



(4) 
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Such special convex optimization problems can be solved 
efficiently using standard tools to obtain the exact opti- 
mum, even for large dimensions. 

Available information and its description. — Let us 
be more precise about which expectation values ki are 
known in a prepare and measure scheme, where Alice 
sends potentially mixed states p™ with a priori probabil- 
ity p(i). This state preparation can be formulated in an 
entanglement based version as follows [ijj : Alice first cre- 
ates a source state |* m ) AbAsB = £i \JW)\i) aJpD a 8 b> 
where |/3™)a b denote purifications of the signal states 
p™ to a shield system A s [l8l |. Afterwards, she measures 
her bit system Ab in the standard basis, thereby pro- 
ducing the correct signal state at site B which is sent to 
Bob. Eve transforms the overall source state to the final 
tripartite state Pabe with A = AbA s . On the receiving 
side, Bob performs a measurement modelled by B^. As a 
result, both Alice and Bob observe the expectation values 



of \i), 



1a (8> -Bfc- Moreover, since Eve is restricted 
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to interact only with Bob's system, the reduced density 
matrix p™ — tr B E (p™be) ^ s fixed and directly given by 
the source state. This information can be added by in- 
cluding expectation values of ® 1b, where Tk denotes 
a tomographic complete operator set on A. Both sets of 
observables constitute the previously denoted set Ki. 

The signal states and performed measurements in prac- 
tical DPR-QKD are described by operators on an infinite 
dimensional Fock space of several modes. In order to ap- 
ply the de Finetti argument [l2| , and to numerically ob- 
tain an upper bound on the phase error using Eq. (0}, it 
is necessary to formulate this problem in a manageable, 
finite dimensional form. Clearly, system A^, is finite. For 
Bob's measurements one can employ the squash model 
argument (l9j . Here the real measurement is notionally 
decomposed into a two step procedure by first applying 
a map that transforms any incoming signal to a finite di- 
mensional output state on which a specified target mea- 
surement Bk is performed afterwards. Since this map 
can be even given to Eve, its output state only lowers 
the key generation capabilities of Alice and Bob, and one 
readily works in finite dimensions. For our simulations 
we assume that Bob has at his disposal inefficient photon 
number resolving detectors with state independent dark 
counts. Also, we consider that only the single photon 
events within the whole block are finally considered as 
conclusive. In this case the map outputs either a single 
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FIG. 1. Schematic description of a COW protocol with 
an active measurement choice. Bob reads the raw key in de- 
tector Dd- Moreover, he uses an optical switch to send some 
pairs of consecutive pulses to a monitoring line that examines 
the coherence between even and odd pulses sent by Alice. 



photon, measured with the perfect detection scheme, or 
an auxiliary state that triggers all inconclusive events. 

For the shield system A s one uses only partial informa- 
tion of the reduced state. In the case of phase randomized 
signal blocks, an example that we consider later, a purifi- 
cation is given by storing the total photon number of the 
block in the shield system \n) A . Using only tomography 
on the subspace spanned by all n = 1, ... , n cut , together 
with an ancilla state |7V) A for all other cases, the shield 
system can effectively be described in finite dimensions. 

Description of the protocol. — To illustrate our results 
we analyze the security of a variant of the COW proto- 
col • The basic setup is shown in Fig. [T] Alice uses 
a laser, followed by an intensity modulator (IM), to pre- 
pare a sequence of coherent states |0)|a) and |a)|0). On 
the receiving side, Bob employs an optical switch to dis- 
tribute each pair of incoming pulses into the data or the 
monitoring line poj ]. The data line measures the arrival 
time of the pulses in detector and creates the raw key. 
Whenever Bob sees a "click" in this detector in say time 
instance i, he decides at random whether to publicly an- 
nounce a detection event in time instances i and i + 2 or 
i and i — 2. The first case is associated with a bit value 
"0" , while the second one corresponds to a bit value "1" . 
If the state sent by Alice in these time instances is |0)|a) 
(|a)|0)) then she assigns to it a bit value "0" ("1") and 
tells Bob to keep his result. Otherwise, the result is dis- 
carded and does not contribute to the sifted key. Let us 
illustrate this procedure with a simple example drawn in 
Fig. [T] and assume that Bob observes a click in in 
time i. If he announces the pair i and i + 2, then this re- 
sult is discarded. Note that in this case Alice sent |a)|a) 
and hence she cannot infer in which time slot Bob saw a 
"click" . On the contrary, if Bob reports i and i — 2, then 
both parties assign to it a bit value "1" . The monitoring 
line checks for eavesdropping by measuring the coherence 
between subsequent even and odd pulses sent by Alice. 
This is done by interfering adjacent pairs of pulses in a 
50 : 50 beamsplitter and measuring the output states in 
detectors D + and D_. 



In the security analysis we assume that Alice and Bob 
discard coherence information between consecutive sig- 
nal blocks. Moreover we consider that the sifted key 
is created only from signals within the same block. To 
guarantee this, one could discard those detection events 
where Bob declares time instances that belong to differ- 
ent blocks. Alternatively, one could change Bob's public 
announcement slightly. For example, one can reorder the 
2m possible detection time slots of a given block to form 
a closed chain with the first and last time instances con- 
nected. Now, if Bob observes a "click" in the data line in 
say the first time slot he announces a detection event in 
time instances one and three or one and 2m— 1 with equal 
probability, and similar for the other cases. This strategy 
preserves the original symmetry in Bob's announcement 
and we use it in our simulations. 

Simulation. — For simulation purposes, we consider 
that Bob's detectors are identical and have a dark count 
rate of 10 -7 . The channel model includes an intrinsic 
error rate of 1% in the data line together with an addi- 
tional misalignment in the monitoring line that reduces 
the interferometric visibility to 99%. More details on 
this channel model and on the adapted security discus- 
sion to the COW protocol are given in the appendix. We 
study two different scenarios: (a) the case where all dif- 
ferent m-signals blocks share the same phase, and (b) 
the scenario where each block is phase randomized. The 
resulting lower bounds on the secret key rate per pulse, 
i.e., R m /(2m), are illustrated in Fig. [2] For compari- 
son, this figure includes as well a lower bound on the se- 
cret key rate for a coherent-state version of the standard 
BB84 protocol [2l| with and without phase randomiza- 
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23j. For a given total system loss, i.e., including 
the losses in the channel and in Bob's detection appa- 
ratus, we optimize the lower bound over the respective 
signal strength a of Alice's source which is of order 0.1. 
As expected, we find that case (b) performs better than 
that where all blocks share a common phase, since the 
signal states are less distinguishable for an eavesdropper 
without a global phase. We obtain that the tolerable 
system loss for the COW protocol is, respectively, ~ 19.5 
dB (a), and « 22.6 dB (b). The bit error and visibility 
at these cutoff points are, respectively, « 3% and « 96% 
(a), and « 5.3% and ss 93.3% (b). Let us remark that 
the lower bound with m — 2 even holds for threshold 



detectors [24 [ 



Our simulations reveal that a main limiting factor in 
DPR-QKD seems to be the dark count rate of Bob's de- 
tectors. For given experimental parameters, there is an 
optimal finite block size that allows a maximum tolerable 
total system loss. If one increases the block size further 
this does not translate into an improved lower bound 
or distance. This is due to the fact that, in the high 
loss regime, large sized blocks suffer from a higher dark 
count probability per block than smaller sized blocks, and 
this reduces the achievable secret key rate. A similar ef- 
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FIG. 2. Lower bound on the secret key rate given by Eq. ((2j) 
per pulse on a logarithmic scale (base 10) vs. the total sys- 
tem loss in dB for the COW protocol illustrated in Fig. [T] 
using signal blocks carrying m bits of information (i.e., 2m 
optical pulses) in the security proof. The upper figure corre- 
sponds to the case where all blocks of signals share a common 
phase, while the lower figure represents the situation where 
each block is phase randomized. For comparison, we include a 
lower bound on the secret key rate for a coherent-state version 
of the standard BB84 protocol [2lJ with and without phase 
randomization [221 . [23j]. We consider three main error con- 
tributions: an intrinsic error rate of 1% in the data line, an 
additional misalignment in the monitoring line reducing the 
visibility to 99%, and a dark count rate in the detectors of 
10 -7 . Moreover, in the lower figure we assume n cu t = 2. 



feet was already observed in the security analysis for the 
differential-phase-shift protocol with true single photon 
sources [l(|. For a dark count rate per pulse of 10~ 7 the 
optimal block size in the COW scheme turns out to be 
m = 3, i.e., 6 optical pulses. Also, this figure shows that 
a coherent-state version of the BB84 protocol without 
decoy states can deliver notably higher key rates per sig- 
nal than the analyzed COW protocol assuming the same 
channel model. The reason for this might be threefold: 
(1) the small optimal block size in the COW scheme; (2) 
considering blocks, it can be shown that certain multi- 
photon pulses are completely insecure; (3) most impor- 



tantly, while in the BB84 the phase error is measured 
directly, in the COW protocol it has to be estimated. 

Possible improvements. — To further improve the lower 
bounds shown in Fig. [5] there are several alternatives. 
Since a main limitation seems to come from dark counts, 
one may consider security in the fully calibrated device 
scenario where these errors are not attributed to Eve. 
As a quantitative bound on the performance of this sce- 
nario we investigated the case of a zero dark count rate, 
in which all key rate bounds shown in Fig. [5] shift by 
about 3 dB, though the difference between the COW and 
the BB84 protocol remains. Additionally, one can evalu- 
ate different public announcements in a similar spirit like 
the SARG protocol [25j. We considered different decla- 
rations, but unfortunately none of them enhanced the re- 
sulting key rate 26[. Another possibility is to include, for 
instance, an extra monitoring line on Bob's side to addi- 
tionally check the coherence between subsequent pulses. 
The state distribution part of this protocol is then very 
similar to the one of the original COW scheme Q with an 
additional decoy signal composed by two vacuum pulses 
as proposed in Ref. Q. This hardware change improves 
the maximum tolerable system loss by about 1 dB. 

Another hardware change might be to include addi- 
tional phase differences in the signal stream, such that 
the signals states get closer to the one used in a BB84 
protocol. Finally, one may ask whether different secu- 
rity techniques might provide better lower bounds. For 
instance, one could consider more valid detection events 
per block. This needs however much larger block sizes 
such that one obtains at all a reasonable fraction of two 
or more click events in the long distance limit. Another 
alternative would be to bound the rate by the individual 
phase errors, i.e., directly using Eq. (fl}. This could give 
a benefit if, for example, bits at the boundary are much 
easier to infer by Eve than bit values originating from 
events well inside the block. Moreover, it might be of ad- 
vantage if Eve's information is estimated by using differ- 
ent, possibly not mutually unbiased basis measurements. 
Here the more general key rate formula of Ref. [l4[ could 
be used. Clearly another option would be to abandon 
the block idea. However even in this case Eve could al- 
ways attack the signals block-wise. Though a coherence 
measurement across blocks would then reveal the eaves- 
dropper, any coherence measurement within them would 
be still fine. Hence when considering only an average 
visibility this effect will become less and less important. 
All these alternatives definitely deserve further investiga- 
tions, but we do not expect a dramatic improvement. 

Conclusion. — We have presented a generic method to 
prove security of practical DPR-QKD against general at- 
tacks. With the explicit example of a variant of the COW 
protocol, we have shown that these schemes are indeed 
secure for certain distances at given rates. Its perfor- 
mance, however, seems to be less robust against practical 
imperfections than originally expected. 
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and Quantum Information (Cambridge University Press) 
(2000). 



APPENDIX 

In this appendix we apply the described security 
method to the explained version of the COW proto- 
col [Tl| | . In particular, we consider signal blocks carrying 
m bits of information. Since a single bit comprises two 
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modes, one has 2m different temporal modes described 
by their creation and annihilation operators o| and a s , 
respectively, with s = 1, . . . , 2m. We assume that the 
l-th bit relates to the modes with s = 21 — 1,21. 

Real and assumed measurement description. — At first 
let us concentrate on the real measurement model M£ eal 
and the way how we describe it in the security part, de- 
noted as Bk in the main text. For the real measurement 
setup we assume inefficient photon number resolving de- 
tectors that suffer from state-independent dark counts. 
The inefficiency of Ml is modelled by a global beam- 
splitter (BS) of transmittance 77det located in front of a 
perfectly efficient scheme, labelled as that still suffers 
from dark counts. This is schematically drawn in the first 
line of Fig. [3l In a second step, one models the efficient 
scheme M% as a map A s , sometimes called squashing or 
filter operation (l9j . in front of the assumed description 
Bk . Let us emphasize that the security simulation is valid 
for any true measurement scheme that can be modelled 
as a physical map A followed by the measurement Bk as 
shown in the third line of the figure. 



Mr 1 



BS 

»7det 



Efficient 
scheme 

Mi 



BS 

lldet 



A, 



A 



FIG. 3. Decomposition of Bob's measuring device. 

There arc three different types of outcomes for the so 
far abstract outcome label "fc" . For a data line measure- 
ment we use d, with d = 1, . . . , 2m, to denote a single 
photon detection in temporal mode d only. The corre- 
sponding measurement operator M d is given by 



e(l - e) 2m - 1 |vac)(vac| + (I - e) 2m \d){d\, (5) 



with e representing the dark count probability of Bob's 
detectors and \d) = a^jvac). In addition to a data line 
measurement Bob can also perform coherence measure- 
ments on subsequent bits employing the monitoring line. 
For instance, whenever he tests the coherence between 
bits I and I + 1 he effectively mixes the modes 21 — 1, 2Z + 1 
and, at the same time, 21, 21 + 2. For each pair of modes 
there are two single photon events, denoted as ±, that 
can be distinguished, depending on whether the single 
excitation is registered in the bright (D + ) or in the dark 
(D_) detector. As an outcome label for the coherence 
measurements we use k = (c, ±), where c = I , . . . , 2m— 2 
denotes the first of the two interfering modes. In this case 
the measurement operators are given by 



with \xt) — (|c) ± \c + 2))/v / 2- Let us emphasize that 
in these coherence measurements it is still necessary to 
check that all other modes are empty. Finally, note that 
each measurement setting has also other possible out- 
comes, e.g., "no click" or more than a single photon de- 
tection event. All these cases are grouped (via classical 
post-processing) into a single inconclusive outcome de- 
scribed by M inc . 

As the modelled measurement operators Bk we use 



B d = \d){d\, 

B c ,± = \xt)(xt\, 
B m c = \a)(a\, 



(7) 



where |o) is the auxiliary state that describes the incon- 
clusive outcome. These measurement operators Bk act 
on a 2m + 1 dimensional Hilbert space. 

Both measurement sets can be made equivalent by an 
appropriate map A s such that tr(pMfe) = tr[A s (p)_B/ £ ] 
holds for all possible states p and measurement outcomes 
"fc" as schematically shown in Fig. [3] This map A s is 
given as follows. First one measures the total number 
of photons n within an arriving block. Whenever one 
finds n > 2 one outputs the auxiliary state \a). If n = 1 
then with probability (I — e) 2m the single photon state 
stays untouched, otherwise the auxiliary state is thrown 
again. Finally, for n = the map creates the completely 
mixed single photon state ^ fc \k)(k\/2m with probability 
2me(l — e) 2m_1 and \a) otherwise. This map is physical 
because we explicitly describe it in terms of measure- 
ments and conditional signal state preparations. 

Source state and reduced density matrix. — The follow- 
ing discussion provides the source states for both cases 
of pure or phase randomized COW block signals. These 
states determine the reduced density matrix p™ which 
belongs to the available information. 

Let us consider first the case of pure signal states. In 
the COW protocol analyzed Alice sends to Bob either 
the sequence \a, Q) or |0, a), with a € 1R, depending on 
whether her raw key bit value is "0" or "I" . Let us start 
with the scenario where Alice sends to Bob only one bit 
value, occurring with equal a priori probability. This 
corresponds to a block size m = 1. Then the source state 
is given by 



l* m=1 ) AB = ^(|0)aM) b + |I) A |0,a> 
and its reduced density matrix becomes 



1 



(8) 



(9) 



M, 



c,± 



\2rn- 



1 |vac)(vac| + (f-e) 2m | Xc ± )( Xc ± |, (6) 



Suppose now that Alice sends to Bob m bits according 
to this scheme. If i = (i±,i2, ■ ■ ■ , i m ) denotes the m-bit 
string being sent and |</>i) B refers to the corresponding 
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signal state, then one obtains 



l*" l >AB 



= 2~ 
= I* 1 



i^aI^b 
ie{o,i} m 



/Ai...A m B 



= W^Xb- (10) 



In particular, from the last expression one finds that the 
reduced density matrix p^ is given by 



Pa — \PA ) 



(11) 



Next, let us turn to the case of phase randomized 
blocks. Since randomizing the phase of a block is equiva- 
lent to measuring the total number of photons contained 
in it, the true signals states are of the form 

oo oo 

P ? = ^n„|^) B <^|n n = £pA(n)|^) B «|. (12) 

n=0 ra=0 

Here Tl n stands for the projector onto the n-photon sub- 
space of the 2m different modes. The outcome of such 
a photon number measurement follows a Poisson distri- 
bution p\(n) = e~ x \ n /nl with mean A = ma 2 . The 
projected n-photon signal states \ip l n ) B can be expressed 
as 



m 2 v n 



— vac) B , (13) 

n/! 



»i,...n m 1=1 



where the summation runs over all natural numbers 
ni,...,n m that satisfy $^/=i n i = n - These states ful- 
fill the relation 



(14) 



with Ay being the Hamming distance between the bit 
strings i and j, i.e., the number of places they differ. 

Using the framework of mixed signal states as ex- 
plained in the main text one must now choose an overall 
purification of all signal states |V'«)b- T° r our simulation 
we select 



' A.B 



E 

n=0 



y/p x (n)\n) A \ipi) 



(15) 



which can be seen as a coherent storage of the total pho- 
ton number n in the shield system A s . Let us remark 
that this choice satisfies (p^\pf) = ^(p™,^ 1 ), with F 
being the fidelity of mixed states, which is also the max- 
imal possible overlap between two signal states [27J. We 
find, therefore, that the source state in this scenario is 
given by 



/A b A„I 



iG{0,l}" 



(16) 



with Ab = Ai . . . A m . This means that the reduced den- 
sity matrix p™, with A = AbA s , can be expressed as 



Pa 



= ^_]p\{ n )PA h ® \ n ) Ae ( n \> 



(17) 



with p\ given by 



In our simulation we only use partial information of the 
reduced density matrix p™. In particular, we transform 
A s to A s by making a shield measurement that distin- 
guishes the different photon number cases mentioned in 
the main text such that one obtains 



PA b A s = X>A(nK b ® |n>A>l 



+ E PA(n)p Ab ® \N) Ae (N\, (19) 

n0{l,...,n C ut} 

where |iV)x denotes an auxiliary system for all higher 
photon numbers. Let us point out that considering the 
reduced state given by Eq. ([T91) can be understood as 
"tagging" the n = 1, . . . , n cut signal states [22 1. 

Announcement maps and phase operator. — The spe- 
cific announcements v of the COW protocol can be 
phrased in terms of appropriate maps A„ on the quantum 
state. Together with a chosen "phase setting" measure- 
ment this provides a concrete expression for the averaged 
phase error operator F$ used in Eq. ([3]). 

As explained in the protocol description, Bob an- 
nounces two consecutive even or odd time slots where 
he registered his single photon event. Suppose, for in- 
stance, that he announces v = {21— 1, 21 + 1). These are 
the first arrival times of the modes associated with bits 
il and ii+i sent by Alice. In such cases, Alice and Bob 
agree to call the outcome in the first time instance "0" 
while the later event is "1". This announcement can be 
modelled as a filter operation A^(p) = F^pF^ given by 



1 

V2 



F? = -4= (|0) SB (2Z - 1| + |l) SB <2i + 1|) ■ (20) 



If Bob measures system B in the standard basis |0) B , |1) B 
he obtains the real outcome he has observed. The pre- 
factor l/v2 which appears in Eq. (f20| takes into account 
that whenever Bob sees a single photon click in either 
21 — 1 or 21 + 1 he announces this particular v with just 
50% probability, i.e., F^F* = (B 2l ^ + B 2l+1 )/2. 

Suppose Bob has actually declared v = (21 — 1, 21 + 1). 
Then, Alice has to look on her bit string to determine 
whether she can conclusively infer Bob's bit value. For 
that, only her bits ii and ii+i matter. As shown in Fig.SJ 
if these two bits are equal it means that she had sent to 
Bob either two full or two empty pulses. In this scenario, 
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she cannot infer Bob's bit value and they discard this 
result. However, if these bits differ then she knows Bob's 
sifted bit value precisely (in the error free case) and she 
tells Bob to keep it. Such a conclusive announcement 

Alice's bits Bob's declaration Alice's declaration 
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FIG. 4. Announcement choices for Alice given that Bob has 
declared a detection event in time slots 2Z — 1 and 21 + 1. 

by Alice can similarly be modelled as a filter operation 
A* acting on her qubits I and 1 + 1, i.e., A A (p™ A ) = 

^ A PA lAl+1 ^ At With 

^ A =|0)a Aj a j+1 <01| + |1) AAjAi+i <10|. (21) 

Again a measurement in the standard basis |0) A ,|1) A 
provides Alice with her real outcomes. 

In order to determine the phase error 5 V we assume 
that both parties perform measurements in the A-basis, 
i.e., they project the output signals from their filter op- 
erations onto the states |±) = (|0) ± \\))/\/2. Then, the 
symmetrized phase error 5 V = p{+, — ) + %>{—, +) can be 
expressed as 

p(v)S v = p(«)tr[-(l <S)l-<7 x (g> a x )af %v ] 



1 



p(v)-tr(X A ®X B p% B ), 



(22) 



with a x denoting the Pauli matrix a x — |0)(1| + |1)(0|. 
In the last line of Eq. (|22|) we have defined the operators 



X' A = 1ax...Ai_i ® A A (g) lA 1+2 ...A m) 

= i (121 - I) (21 + 1| + \2l + I) (21 - 1|) , (23) 

with A A = F^a x F£ = |01)(10| + |10)(01|. 

Similar arguments apply to the cases where Bob an- 
nounces subsequent even outcome pairs or the special 
instances at the borders of the blocks. We find that the 
averaged phase error 5 = X^ev p( v )^v can be written as 



vev c 



(24) 



with an operator Aj = J2l=i Xa-a ® Xb-i- Here A A; ; 
denotes the operator composed by the previously defined 



A A acting on qubits I and I + 1 and the identity operator 
acting on the remaining qubits (I — m means the first 
and last qubit). On Bob's side the operators Ab ; z are 
given by 

A B;i = ](\2l - l)(2l + 1| + \2l + l)(2l - 1| 



-|2Z) <2Z 



+ \2l- 
\2l + 2)(2l\), 



(25) 



with addition being carried out modulo 2m. 

Channel model. — In this section we present the em- 
ployed channel model of the COW experiment used in 
our numerical simulations. Note, however, that the re- 
sults presented in this article can be applied as well to any 
other quantum channel, as they only depend on the ob- 
served detection probabilities in both the data and mon- 
itoring lines. 

In particular, we characterize the losses in the channel 
with a BS of transmittance ?7channci- This parameter can 
be related with a transmission distance d measured in 
km for the given QKD scheme as 



^channel 



= 1(T 



(26) 



where a represents the loss coefficient of the channel (e.g., 
an optical fiber) measured in dB/km. Together with the 
efficiency of the detectors the overall system transmit- 
tance is given by 



^?sys — ^7channcl^?dct ■ 



(27) 



The total system loss in dB is used as the x-axis in the 
secret key rate figures, i.e., — 10 log 10 r] sys - 

The channel misalignment is parametrized with an er- 
ror probability ed that a signal hits Bob's detectors in 
the wrong time slot within the same bit. For simplic- 
ity, we assume that ed is a constant independent of the 
distance and we use ed = 1% for simulation purposes. 
This effect is modelled by a completely positive trace- 
preserving map $ that incoherently flips the signal states 
within the same bit slot as |0, yjri sys a) t-> \^/rj sys a, 0) and 
| y/r] S y S a, 0) i y |0, y/r] S y S a) with probability ed- Here we 
consider that the input signals have been already affected 
by system losses. We have, therefore, that whenever Al- 
ice sends to Bob a corresponding COW signal state with 
coherent state \a) in temporal mode d, the probability 
that Bob observes a single photon detection event in this 
mode only (within the whole signal block) is given by 



+ (1 - e) 2m (l 



)]M d ] 
e d )r] S y S ije 



e(l - e) 2m - 



(28) 



where p™ ss represents the output signal of the BS char- 
acterizing the total system loss, /i = a 2 , and A = to/i. 
Similarly, when Alice sends to Bob a vacuum state in 
temporal mode d Bob can observe a single photon detec- 
tion event in this mode only with probability 



error 
Pd 



e(l - e )a™-i e -*»- A 

+ (1 - e ) 2m e d r ?sys /ie-^ A . 



(29) 
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The total probability that Bob observes an inconclusive 
detection event in the data line is then given by 



Pine = 1 



error 
Pd 



(30) 



In the monitoring line we include an additional mis- 
alignment effect that reduces further the interferometric 
visibility. In particular, we assume that whenever two 
equal coherent states interfere at a 50 : 50 BS then the 
outcome signal can exit the BS through the wrong output 
port with error probability e m . In our simulations we use 
e m = 0.5%. Here we distinguish two possible scenarios, 
depending on whether the signals which interfere at the 
BS were prepared by Alice in the same quantum state or 
not. Let us assume that the first signal corresponds to 
bit ii while the later to bit ii+i- That is, Bob interferes 
modes 21 — 1, 21 + 1 and, at the same time, 21, 21 + 2. 

Let us consider first the situation where both signals 
were generated in the same state |0, a). In this scenario, 
we find that Bob observes a single photon detection event 
in temporal mode 21 — 1 only (and no click in the remain- 
ing modes of the block) with probability 

P2J-1.+ = e(l ~ e) 2 ™-^-*^ + (1 - - 

x [2(l-e d ) 2 (l-e m ) + e d (l-e d )] , 

P21-1,- = e(l - e) 2m ~ + (1 - e) 2m W e-"- A 

x [2(l-e d ) 2 e m + e d (l-e d )] , (31) 

where the superscript ± indicates whether the single ex- 
citation is registered in the bright (D+) or in the dark 



(D_) detector of the monitoring line. Similarly, we have 
that the probability that Bob sees a single photon detec- 
tion in temporal mode 21 only is given by 

p 2U+ = e(l - e )2™-l e -*y S A + (1 _ (i ^, h>ll( 'i , A 

x [2e 2 (l-e m ) + e d (l-e d )] , 
p 2i ,_ = e(l - e fm-l e -r,srsX + (1 _ efm^^-^X 

x [2ele m + e d (l - e d )] . (32) 

The case where both signals were generated in the same 
state | a, 0) is completely analogous. One only needs to 
interchange Eqs. (|3"Tj) and (|32|) . 

Finally, let us consider the situation where both sig- 
nals are prepared in a different quantum state. In this 
scenario the probabilities are given by 



P2l-1,+ = P2L 



e(l-e) 



2m— 1 -r] sys \ 



+ (1 - <r'" " x 



2e d (l-e d )(l-e m ) + 



1 + 2e 2 - 2e d 



,(33) 



and 



P21-1, 



P2L- 



= e(l - e fm-i e -vsysX + (1 _ e ) 



2e d (l - e d )e m + 



1 + 2ei - 2e d 



(34) 



